Avora Agent Forge Authentication

generated: '2026-08-09'
method: searched
source: >-
  https://avora-agent-forge.netlify.app/llms.txt +
  https://avora-agent-forge.netlify.app/agent-forge/pricing.json +
  openapi/avora-agent-forge-commerce-openapi.json
docs: https://avora-agent-forge.netlify.app/ai/
summary:
  types: [none]
  api_key_in: []
  oauth2_flows: []
  model: unauthenticated-public-with-onchain-settlement-gate
schemes: []
notes: >-
  Neither OpenAPI declares a components.securitySchemes block and neither declares a
  top-level security requirement, so every documented operation is callable anonymously.
  This is intentional rather than an omission: the provider states access is
  unauthenticated and that paid tiers are gated by non-custodial, user-signed Solana Pay
  (USDC) settlement verified on-chain instead of by API keys.
authorization:
  model: proof-of-payment
  mechanism: Solana Pay (USDC) on Solana mainnet
  custody: non-custodial
  wallet_approval_required: true
  gate_operation: verifyPaymentAndDeliverEvidence
  validated_fields:
    - recipient
    - USDC mint
    - amount
    - reference
    - product
    - subject hash
    - campaign memo
    - payment age
  denial_status: 402
  denial_meaning: Matching on-chain payment not found yet.
  note: >-
    The bearer of a paid artifact is whoever can present a matching on-chain settlement
    reference plus orderId. There is no account, no key issuance, and no revocation
    surface - the payment reference is the credential.
response_integrity:
  mechanism: Ed25519 JWS signed receipts
  jwks: https://avora-agent-forge.netlify.app/.well-known/jwks.json
  jwks_file: ../well-known/avora-agent-forge-jwks.json
  operation: getReceiptVerificationKeys
  note: >-
    Public-sector assessments return an Ed25519 JWS receipt that any third party can verify
    against the published JWKS without contacting the provider. This is response
    authentication, not caller authentication.
gaps:
  - No caller identity of any kind, so per-caller rate limiting, quota, and revocation are
    not expressible.
  - No API key or OAuth surface, so there is no scopes artifact to derive.
  - No /.well-known/oauth-authorization-server or /.well-known/oauth-protected-resource
    (both 404), consistent with the no-auth model.